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The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
eamed patent temn adjustment. See 37 CFR 1.704(b). 

Status 

1 )^ Responsive to communication(s) filed on 16 June 2000 . 
2a)n This action is FINAL. 2b)^ This action is non-final, 

3) 0 Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1, 453 O.G. 213. 
Disposition of Claims 

4) ^ Claim(s) 1-32 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) 13 Claim(s) li32 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) 0 The specification is objected to by the Examiner. 

1 0) 13 The drawing(s) filed on 16 June 2000 is/are: a)[3 accepted or b)^ objected to by the Examiner. 

Applicant may not request.that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

1 1) 0 The proposed drawing correction filed on is: a)n approved b)n disapproved by the Examiner. 

If approved, corrected drawings are required in reply to this Office action. 

12) 0 The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§ 119 and 120 

13) n Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a)nAII b)n Some*c)n None of: 

1 .□ Certified copies of the priority documents have been received. 

20 Certified copies of the priority documents have been received in Application No. . 

3.n Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau {PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) n Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 1 19(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

15) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121. 
Attachment(s) 

1 ) ^ Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-41 3) Paper No(s). . 

2) D Notice of Draftsperson's Patent Drawing Review (PTO-948) 5) □ Notice of Infomnal Patent Application (PTO-1 52) 

3) ^ Information Disclosure Statement(s) (PTO-1 449) Paper No(s) Z . 6) □ Other: 
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DETAILED ACTION 



Claim Rejections - 35 USC § 102 

1. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

2. Claims 1-5,9-14,18-25,29-32 rejected under 35 U.S.C. 102(b) as being 
anticipated by Chatterjee et al. 

Regarding Claim 1 , Chatterjee et al teach a process control system capable of 
executing a function after initiation thereof, the process control system comprising: 

a computer having a memory and a processing unit; and 

a security module stored in the memory of the computer (see col. 5 lines 36-38) 
and adapted to be executed on the processing unit of the computer, wherein the 
security module analyzes security information collected contemporaneously with the 
initiation of the function and in association therewith to determine whether the function 
should be executed (Fig.1; col.5 lines 21-38). 

Regarding Claim 2, Chatterjee et al teach a security system wherein the process 
control system comprises a network and the function is initiated via a device external to 
the network (Fig.1; col.4 lines 4-8; col.4 lines 17-34). 
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Regarding Claim 3, Chatterjee et a! teach a security system wherein the device 
includes a client that generates a user interface to collect the security information (col. 4 
lines 4-16). 

Regarding Claim 4, Chatterjee et al teach a security system wherein the client 
passes the security information in encrypted form to the security module (col.5 lines 7- 
13; col.5 lines 21-27; col.5 line 66 thru col.6 line 1). 

Regarding Claim 5, Chatterjee et al teach a security system further comprising a 
process control application stored in the memory of the computer and adapted to be 
executed on the processing unit of the computer, wherein the process control 
application generates a security configuration interface for establishing a security 
parameter for the function executed by the process control system (col.5 line 43 thru 
col.6 line 1 ). 



Regarding Claim 9, Chatterjee et al teach a security system wherein the process 
control system comprises a network and the computer resides at a node of the network 
(Figs.1 and 2). 
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Regarding Claim 10, Chatterjee et al teach a security system further comprising 
a process control application stored in the memory of the computer and adapted to be 
executed on the processing unit of the computer, wherein the process control 
application generates a user interface to collect the security information from the user 
(Figs.1 and 2; col.4 lines 4-16; col.5 lines 34-38). 

Claims 11-14 are method claims that are substantially equivalent to security 
system claims 1-4 respectively. Therefore claims 11-14 are rejected by similar rationale. 

Regarding Claim 18, Chatterjee et al teach a method of securing a process 
control system capable of execution of a function, the method comprising the steps of: 

establishing a communication link between the process control system and a 
device external thereto to provide for remote initiation of the execution of the function 
(Figs.1 and 2; col.4 lines 17-19; col.5 lines 7-13); 

generating a user interface via the communication link for collection of security 
information {col.4 lines 4-16); 

determining whether the remote initiation of the execution of the function is 
authorized based on the collected security information (col.5 lines 21-33). 

Claim 19 is a method claim that is substantially equivalent to security system 
claim 3. Therefore claim 19 is rejected by similar rationale. 
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Regarding Claim 20, Chatterjee et al teach a software system for a process 
control system capable of execution of a function, the software system comprising: 
a computer-readable medium; 

a first routine stored on the computer-readable medium that collects security 
information contemporaneously with the initiation of the function and in association 
therewith; 

a second routine stored on the computer-readable medium that determines 
whether the execution of the function is authorized in accordance with the collected 
security information (col.4 lines 4-16; col. 5 lines 21-33). 

Regarding Claim 21 , Chatterjee et al teach a software system wherein the first 
routine is executed in a client-server configuration such that the collected security 
information is transmitted from a client to a server (col. 5 lines 7-13). 

Regarding Claim 22, Chatterjee et al teach a software system wherein the 
security information is collected via a user interface at the client (col.4 lines 4-16). 

Regarding Claim 23, Chatterjee et al teach a software system wherein the client 
is external to the process control system (coL3 lines 13-17; col.4 lines 17-27). 
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Regarding Claim 24, Chatterjee et a! teacli a software system comprising a third 
routine that encrypts the collected security information prior to transmission from the 
client to the server (col. 5 lines 7-13; col. 5 lines 21-27; col.5 line 66 thru col.6 line 1 ). 

Claim 25 is a software system claim that is substantially equivalent to security 
system claim 5. Therefore claim 25 is rejected by similar rationale. 

Claim 29 is a software system claim that is substantially equivalent to method 
claim 18. Therefore claim 29 is rejected by similar rationale. 

Claims 30,31 are software system claims that are substantially equivalent to 
security system claim 3. Therefore claims 30,31 are rejected by similar rationale. 

Claim 32 is a software system claim that is substantially equivalent to security 
system claim 4. Therefore claim 32 is rejected by similar rationale. 



Claim Rejections - 35 USC § 103 
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3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary sW\\\ in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

4. Claims 6-8,15-17,26-28 rejected under 35 U.S.C. 103(a) as being unpatentable 
over Chatterjee et al as applied to claims 1 ,1 1 ,20 above, and further in view of Brezak 
et al. 

Regarding Claims 6,16,26 Chatterjee et al disclose everything claimed as applied 
above (see claim 5), but do not teach that the security parameter comprises data 
representative of a lock associated with the function executed by the process control 
system. Brezak et al teach a security system wherein the security parameter comprises 
data representative of a lock associated with the function executed by the process 
control system (col.5 lines 45-67 to col. 6 lines 1-3). It would be obvious to one of 
ordinary skill in the art to combine the teachings of Brezak et ars system of user logon 
for network access to Chatterjee et al's workflow control system in order to improve the 
speed of a logon process in a network access control system (see Brezak et al col.1 
lines 53-63). 
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Regarding Claims 7,15,27 Chatterjee et a! disclose everything claimed as applied 
above (see claim 5), but do not teach that the security parameter comprises data 
representative of whether execution of the function requires the security information to 
include a user identification and password. Brezak et al teach a security system 
wherein the security parameter comprises data representative of whether execution of 
the function requires the security information to include a user identification and 
password (col. 5 lines 45-67 to col.6 lines 1-3). It would be obvious to one of ordinary 
skill in the art to combine the teachings of Brezak et al's system of user logon for 
network access to Chatterjee et al's workflow control system in order to improve the 
speed of a logon process in a network access control system (see Brezak et al col.1 
lines 53-63). 

Regarding Claims 8,17,28 Chatterjee et al disclose everything claimed as applied 
above (see claim 5), but do not teach that the security parameter comprises data 
representative of whether execution of the function requires the security information to 
include verification information. Brezak et al teach a security system wherein the 
security parameter comprises data representative of whether execution of the function 
requires the security information to include verification information (col. 5 lines 45-67 to 
col.6 lines 1-3). It would be obvious to one of ordinary skill in the art to combine the 
teachings of Brezak et al's system of user logon for network access to Chatterjee et al's 
workflow control system in order to improve the speed of a logon process in a network 
access control system (see Brezak et al col.1 lines 53-63). 
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Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Tremayne M. Norris whose telephone number is (703) 
305-8045. The examiner can normally be reached on M-F 7:30AM-5:00PM alternate 
Fridays. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gregory Morse can be reached on (703) 305-4789. The fax phone number 
for the organization where this application or proceeding is assigned is (703) 872-9306. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305- 
3900. 

Tremayne M. Norris 
October 31, 2003 




MATTHEW SMITHERS 
PRIMARY EXAMINER 



